[New Rule] Clearing Windows Security Logs

[janniten]

Issues

Resolves #500

Summary

Detecting if security logs were cleared is not only important in order to detect hacker's malicious activity but also when you are under strong security regulations (like Sarbanes and Oxley or PCI), where you need to keep track of the administrator's tasks and ensure that audit trails are not altered/cleared.

Existing rule Clearing Windows Event Logs does not detect the activity of clearing security logs in this two situations:

• If the security logs are cleared from the Event Viewer GUI, either for a legal admin or not. This is because of the existing rule analyzes processes and command line arguments in the 4688 windows event and in the case of clearing from GUI no 4688 event is generated
• If Include command line in process creation events is not enable in the local policy, command line arguments are not completed in the 4688 event, and therefore is not possible to know which action was made (cannot detect the arguments Clear-EventLog in a powershell's execution or cl in WevtUtil's execution)

When a security log is cleared using any method (powershell, wevutil or GUI) the windows event 1102 - The audit log was cleared is generated is always present
This rule is based on this event and ,in my opinion, can be a good complement to the existing rule Clearing Windows Event Logs

Contributor checklist

• Have you signed the contributor license agreement?
• Have you followed the contributor guidelines?

[janniten]

Running the python - detection_rules test I've the following error

[threat-punter]

@Samirbous do you have an environment up and running to test this query? If not, I can spin up an environment to test it out before reviewing the PR.

[Samirbous]

@threat-punter I don't have winlogbeat setup, but IIRC @randomuserid has one ?

[threat-punter]

@janniten do you have a screenshot of the query and matching event(s) in Kibana?

[brokensound77]

Thanks for the contribution. I left a few suggestions and comments

[janniten]

@threat-punter , Here the screenshot and the detection in my environment

[threat-punter]

Thanks @janniten. The slightly modified query below will return results when the Security event logs or other event logs, such as Application, System, or Microsoft-Windows-PowerShell/Operational are cleared. Windows Event IDs: 104 and 1102

I've made some suggestions in your pull request to apply when you're ready.